Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability in FreeScout allows an authenticated administrator to modify sensitive mailbox settings that are not normally exposed in the user interface. This could lead to unauthorized actions like silently forwarding emails or redirecting outgoing mail through an attacker-controlled server. Teams should pay attention because it can be exploited with a single request and allows for persistent data exfiltration even after a session ends.
- Affects self-hosted help desk systems.
- Allows unauthorized email access.
- Can silently reroute outgoing mail.
Attack Path
How an attacker could exploit the issue
An authenticated administrator can exploit this vulnerability by making a crafted request to modify mailbox settings. This allows them to invisibly inject parameters that can exfiltrate emails, redirect mail through their own server, or enable malicious auto-replies.
- Authenticated admin access needed.
- Target mailbox connection settings.
- Admin must submit request.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability in FreeScout allows an authenticated administrator to abuse mass assignment to silently exfiltrate all outgoing emails or redirect them through an attacker-controlled server. This is a significant threat in environments with multiple administrators, enabling hidden surveillance and phishing opportunities. The patched version has been released, but the exploitability prior to the fix remains a concern.
- Exploitable by authenticated admin.
- No public exploit code.
- Patch available for version 1.8.213.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize patching FreeScout to version 1.8.213 to remediate the mass assignment vulnerability. If immediate patching is not feasible, isolate affected services to prevent exploitation via modified connection settings that can redirect emails or alter configurations.
- Update FreeScout to 1.8.213.
- Restrict access to mailbox settings.
- Monitor outgoing emails for anomalies.
